Questions tagged [luks]
LUKS (Linux Unified Key Setup) is a disk-encryption specification. It is the standard for Linux hard disk encryption.
162
questions
0
votes
1
answer
24
views
systemd-cryptenroll for LUKS volume with detached header
I have encrypted LUKS volume with detached header and I want to open it using TPM. Problem is systemd-cryptenroll doesn't have option for detached header. Is it possible to overcome this or perform &...
- 175
0
votes
1
answer
57
views
Linux LUKS Encryption - On-demand or FULL in advance?
When encrypting a device using LUKS, it seems to be encrypted "on-demand", I mean, apart from the encryption header data is encrypted "on-the-go" as it is written to the device and ...
- 115
0
votes
0
answers
27
views
Encrypted backup duplication without decrypting (rsync or other)
I have a LUKS filesystem in a sparse file, containing a lot of backed up files.
I would like to regularly copy this backup elsewhere (off-site), with read speed and bandwidth constraints (not ...
- 139
1
vote
0
answers
191
views
Linux: encrypting a second disk without having to type the password on reboot
It is a long story but to make it short, we want to encrypt a newly attached disk but do not want to type the disk password on every boot -- inputting the disk password at the very first reboot is ...
1
vote
1
answer
139
views
Move DRBD device to different underlying device without need of re-sync?
I have a pretty large DRBD device connected through WAN. It is a bout 2TB in size and the change rate of the data is pretty low.
It is configured on devices as follows:
VirtIO disk (*.img) on QNAP ...
- 23
0
votes
0
answers
175
views
LUKS: encrypting swap without requiring a passphrase on boot?
I have a setup where I have a logical volume (data) that should be LUKS-encrypted. However, my feeling is that the rest of the filesystem shouldn't be encrypted, which gives some advantages:
The data ...
- 221
0
votes
0
answers
370
views
LUKS full disk encryption with decryption key on USB drive
I have alma9 setup with luks full disk encryption. I want to put a decryption key on a usb drive to boot up without a password.
Picking through the various tutorials (mostly for debian), I have this:
#...
- 333
0
votes
0
answers
241
views
Repair a forced fsck-ed LUKS volume
In a moment of distraction, I'v managed to run:
# fsck -Ty /dev/sda1, where /dev/sda1* was a LUKS encypted volume.
I don't have a recent backup, so I can't restore. And the backup I have is for the ...
- 1
1
vote
1
answer
545
views
How to rescue an encrypted LUKS partition that was partially modified by a Windows tool?
On a system with dual boot, the Windows tool Dell SupportAssist started to modify partitions now I ended up with a broken Linux installation.
The Linux installation is/was Ubuntu with an encrypted ...
0
votes
1
answer
747
views
Encrypting root partition with LUKS2 and TPM
I aim to encrypt the root partition and protect the key with TPM. Eventually, I want to lock the encryption key to the state of the TPM registers.
I set up Fedora Workstation 38 - during the setup ...
- 101
0
votes
1
answer
530
views
How do you enforce a custom password policy on LUKS FDE (Ubuntu 22)?
I need to enforce a strong custom password policy for LUKS FDE on Ubuntu 22.
I have successfully enforced it on the user account level by modifying /etc/pam.d/common-password. But the restrictions in ...
- 1
0
votes
1
answer
547
views
Full disk encryption on CentOS 9 Stream with TPM2 decryption at boot time
I'm working on provisioning a server that requires full drive encryption and I want to automate the process of decrypting the drive at startup using the TPM2 module available on the motherboard, but I ...
0
votes
1
answer
2k
views
Rocky 9.1 dracut fails to boot
My rocky 9.1 vm kernel is not able to load/boot/decrypt a LVM Luks2 volume during boot.
Booting with 5.14.0-162.6 works fine. But fails booting the latest 5.14.0-162.18 or 5.14.0-162.12 kernel, dracut ...
- 1
0
votes
1
answer
216
views
LUKS Encryption
I recently cloned my 250GB disk, installed with Fedora37, encrypted with LUKS.
Currently approx. 20 GB disk space is used, the rest is free.
I went ahead and booted from a fedora-live-usb and cloned ...
1
vote
0
answers
369
views
RAID + LUKS + LVM + BCACHE + BTRFS
I want build new structure for my data store (NAS - Ubuntu). Data storage will be 4TB at first. Then up to 8TB.
My old structure is simple:
RAID 1 -> LUKS -> FS
I need some wishes to new ...
- 111
0
votes
1
answer
429
views
Setting up resilient single drive NVMe storage for LUKS encryption
I would like to set up resilient encrypted storage with single NVMe drive for my laptop and its (encrypted) backup (with SATA housing and SSD drive).
This is what I have at the moment:
SSD -> GPT ...
- 143
1
vote
1
answer
792
views
Disable read/write workqueue for Ubuntu Full-Disk-Encryption
I am currently trying to set up multiple devices with Ubuntu (20.04.5 LTS) and the drive must be encrypted, so I used LUKS during the installation. (I checked "Use LVM with the new Ubuntu ...
- 11
1
vote
0
answers
33
views
Why does cdrecord alter my image when writing to CD ROM and how can I avoid it?
I want to use optical media for backups and hence created a luks image equivalent to that of a 80 min CD-ROM and recorded it twice using the cdrecord
# first run
$ cdrecord -v dev=0,0,0 image.luks
# ...
- 117
0
votes
0
answers
2k
views
Unable to connect to dropbear SSH server to remotely unlock LUKS encrypted root partition on Arch Linux cloud server
I intended to setup encrypted LUKS arch linux system on a cloud server.
I installed the latest arch linux version onto LUKS-encrypted partition, configured the initramfs (installed build hooks), then ...
0
votes
0
answers
972
views
Volume group "luks" not found
OS: Parrot OS
VM: Qemu
Filesystem: Btrfs
This is caused due to an improper reboot before full apt upgrade.
After the reboot and entering in the Luks partition password. It successfully decrypts and ...
- 1
6
votes
1
answer
3k
views
How to unlock multiple luks-devices using dropbear-initramfs
My system setup is as following:
One single SSD with LUKS and LVM (and of course an unencrypted boot partition). The debian system is installed there.
Two HDDs assembled as RAID0 with LUKS and LVM ...
- 221
1
vote
4
answers
3k
views
How can I cause systemd to wait starting a unit until a certain condition is fullfilled
I'm still struggling to understand boot sequence dependency configuration in systemd unit files. I've read the manual (systemd.unit).
I tried to add dependencies using the After= and Requires= lines ...
- 719
0
votes
0
answers
79
views
Perform backup of root directory in luks-container form initramfs
My server is running from a root directory in an encrypted luks container with lvm layout.
To perform a backup of the root partition, it is usually the consensus that the filesystem can not be mounted,...
- 1
2
votes
1
answer
3k
views
How do I get logs from my dropbear-initramfs SSH host?
I use dropbear-initramfs (like this) to decrypt the root drive on my Ubuntu 20.04.3 headless server. Recently the server was abruptly powered off (power went out I think?) and now the dropbear SSH ...
- 151
3
votes
1
answer
447
views
ext4 errors with dm-crypt / LUKS on top of an iSCSI device
I have two oldish "NAS" devices, specifically Buffalo TeraStation Rackmount iSCSI ("TS-RIXL/R5"). Those are basically embedded computers running Linux with four SATA slots and two ...
- 101
0
votes
1
answer
821
views
LUKS decrypt on boot with web based key?
Is it possible to configure LUKS to grab a key file from a web server and use it to decrypt and mount the drive on boot?
The idea being that this allows the device to boot, decrypt, and start running ...
- 123
0
votes
1
answer
185
views
Create RAID1 with luks without erase disks
I need to create a RAID1 arrange with an existing phisical disk. I buyed another hdd with same size and I want to create a RAID1 arrange without erasing the first one. My disk have luks encryption, I ...
3
votes
2
answers
5k
views
Is VPS Disk Encryption pointless?
It's relatively straight-forward to create an encrypted storage volume (e.g. Like so: https://www.digitalocean.com/community/tutorials/how-to-create-an-encrypted-file-system-on-a-digitalocean-block-...
- 55
2
votes
0
answers
725
views
Modprobe error at boot
I'm using LMDE4 with LVM on LUKS and recently I've been getting these cryptic error messages at boot:
modprobe: module aes-i586 not found in modules.dep
Volume group "lvmlmde" not found
...
1
vote
0
answers
576
views
Recover encrypted LVM
I had Debian install running on LUKS encrypted LVM.
This morning, I wanted to install OS on external disk to be used on another host, but mistakenly I chose the wrong disk... Few seconds in I noticed ...
- 11
0
votes
0
answers
644
views
Create an Fully Automated Installer for Debian with FAI
I searched on Google about creating Fully Automated Installer for Debian. My aim is to have an ISO file, make it bootable in pendrive. So if I plug this pendrive in a computer, power on the physical ...
- 137
0
votes
0
answers
276
views
How to resize img file created with dd on LUKS-LVM partition?
I have installed a new Debian 10 on /dev/sda with LUKS + LVM. It has the following partition structure:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 79G 0 disk
├─...
- 137
1
vote
1
answer
1k
views
Samba and luks encrypted disk together: Huge performance loss despite plenty of CPU resources, LUKS and samba alone works as expected
Setup:
SSD encrypted with luks aes-xts 512 bits (256 bits AES key), ext4 filesystem
dd write performance of 138 MB/s, CPU usage 97-100 %
dd if=/dev/zero of=testfile status=progress bs=32M count=128
...
- 337
1
vote
1
answer
666
views
LUKS encryption for mounted disk - how to decrypt cinder volume
I have a question about the possible decryption of LUKS volume. I'm testing currently barbican+cinder, but I'm just wondering if there is a way, to somehow decrypt my LUKS volume with payload ...
3
votes
0
answers
2k
views
xfs: can't read superblock
I get the following error:
[root@mediaserv ~]# mount /dev/mapper/media1 /media
mount: /media: can't read superblock on /dev/mapper/media1.
This is Fedora 33. I have a RAID5 of 8x 8TB WD Red drives ...
1
vote
1
answer
121
views
Cryptsetup and partitions
I have the following Centos 7 system that I inherited. Here's the disk setup:
# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 ...
- 11
0
votes
1
answer
959
views
use mount with LUKS2
Back in times of LUKS1, it was possible to use a command like
$ mount /dev/luks-encrypted-partition /mnt/a
[enter passphrase upon being prompted]
as a shortcut for
$ cryptsetup luksOpen /dev/luks-...
- 161
1
vote
1
answer
360
views
HDD bad sector marking through LUKS2 layer (dm-crypt) + ZFS
If having 2x LUKS-encrypted HDDs with a ZFS mirror pool on top of the dm-crypt mapper devices: what happens if one of my HDDs encounters an error and the OS recognizes a sector as bad ?
Will this bad ...
- 13
0
votes
1
answer
206
views
Expand XFS encrypted block device with no LVM
I need to expand my LUKS encrypted XFS volume but I'm not sure where to start as this is about a non-LVM device, its a simple block storage from a cloud provider that I extended from 150GB to 200GB ......
- 101
0
votes
1
answer
232
views
Decrypt file for specific session in CentOS 7
I am looking for a way to encrypt my file that can be decrypted for the current terminal session. The moment we exit the session, it gets encrypted again.
A use case for this scenario would be: Let's ...
- 1
7
votes
0
answers
2k
views
Write performance is 5 times worse with LUKS on top of mdadm RAID10 than without LUKS
I have servers with many NVMe disks. I am testing disk performance with fio using the following:
fio --name=asdf --rw=randwrite --direct=1 --ioengine=libaio --bs=16k --numjobs=8 --size=10G --runtime=...
- 3,250
0
votes
1
answer
526
views
Will encrypting an entire NVMe drive with cryptsetup make it work harder and fail faster than encrypting a partition spanning the disk?
I have several non-boot NVMe disks whose data must be encrypted.
I have been running cryptsetup on the disks themselves without partitioning them, then making a filesystem on the devicemapper device.
...
- 3,250
2
votes
2
answers
4k
views
How do I know a LUKS header is corrupt?
My computer froze for a long time and I pressed the reset button. After reboot, all FIVE luks-encrypted (LUKS 1) file systems will no longer open. The message I get is "No key available with this ...
- 21
0
votes
0
answers
104
views
Read files from an encrypted disk?
Is it possible to read from an LUKS-encrypted disk via the terminal, e.g. by booting from a live Linux system on a USB flash drive and accessing the encrypted host computer's hard drive?
- 101
1
vote
2
answers
2k
views
Is there a good way to shrink disk usage of sparse file containing luks-encrypted btrfs file system image?
I've created a sparse file filesystem.img, formatted in with cryptsetup luksFormat, created a btrfs filesystem on it. The image file disk usage expanding fine while adding files to the btrfs ...
- 126
0
votes
0
answers
333
views
Add keyfile for luks encrypted root
I have a server running ubuntu 18 and we added the standard LUKS encryption during install.
It was fine for a while but its become a problem that we can't restart it remotely.
I'd like to add a ...
- 1
1
vote
2
answers
4k
views
Failed to find logical volume "group/swap"
The error occurs on a LVM/LUKS Debian VPS.
I deleted the swap volume and grew the root volume using the following:
swapoff /dev/group/swap
lvremove group/swap
lvresize -rl +100%FREE /dev/group/root
...
- 771
3
votes
1
answer
2k
views
LUKS high transfer rates followed by high io wait
I'm currently setting up a server on Proxmox VE. I wanted all drives to be encrypted so i chose to setup luks on all disks and on top of luks i set up LVM.
Now when I'm transferring data from a fast ...
- 208
0
votes
1
answer
368
views
LUKS hangs on CentOS running on Atom C3758 CPU
Whenever I try to setup LUKS on my CentOS install on a Supermicro A2SDi-8C-HLN4F motherboard (Intel ATOM CPU C3758), everything seems to work fine until the process completely freezes when creating ...
- 1
0
votes
0
answers
128
views
How to require a password/key/secret supplied by human sysadmin (via an ssh login) for every mount of a LUKS-based volume?
Summary
We want to support this scenario: if we sense any security threat that might expose our core data (all stored on a /home NFS mount from our NFS server), we immediately "hard" power off the ...
- 257